Welcome back. Two weeks ago, Anthropic shipped security scanning into Claude Code and set a new bar for what a coding agent should be able to catch. OpenAI just came back with its own answer: Codex Security.

Also: The exact 6-month roadmap to become an AI engineer, what to check before giving agents production access, and which coding habits are costing you.

OpenAI ships Codex Security to catch real vulnerabilities: The ChatGPT maker just released Codex Security, an agentic tool that scans repositories, builds threat models, and proposes context-aware patches for real vulnerabilities. Unlike standard scanners that often overwhelm teams with false positives, the tool uses sandboxed validation to pressure-test its findings. But that isn’t the only thing: OpenAI also launched Codex for Open Source, giving core maintainers free API credits and six months of ChatGPT Pro.

Anthropic adds background automation and a new app marketplace: The AI lab shipped local scheduled tasks in Claude Code Desktop, letting developers automate recurring jobs like dependency audits and PR triage that run while the machine is awake. Separately, it launched Claude Marketplace, a one-stop shop for enterprises to procure Claude-powered tools from partners including GitLab, Replit, and Snowflake.

Luma's new model brings reasoning into image generation: The AI video startup launched Uni-1, a unified model that understands and generates images in a single pass rather than treating them as separate tasks. It leads the RISEBench leaderboard overall, topping both Nano Banana 2 and GPT Image 1.5. Powered by Uni-1, Luma Agents are now available via API for end-to-end creative workflows.

The experimentation wall just came down. ML research has always been gated by one thing: the speed at which you can run experiments. Over the weekend, OpenAI cofounder Andrej Karpathy cracked that wall open with the release of autoresearch - a repo that puts an AI agent in charge of your ML research loop, automatically rewriting training code and only keeping changes that improve the model.

The proof came before the hype. Shopify CEO Tobi Lutke ran it before any ML team. He pointed the agent at his query-expansion model, went to bed, and woke up to 37 completed experiments — and a 0.8b parameter model beating his previous 1.6b by 19%.

You can run this yourself. Simply clone the repo, upload your training data, and create a “program.md” file outlining your research objectives. Once you point the agent to your GPU, it takes over the rest: editing your Python training scripts, running 5-minute experiments, tracking validation loss, and discarding failures automatically. To help you get up and running, here is a deployment guide.

GitHub wasn't built for what comes next. Karpathy's next step is SETI@home-scale collaboration - agents running asynchronously across thousands of branches on shared compute, and he's already flagged that existing tooling will crack under the load. The moat has shifted from who employs the most researchers to who writes the best instructions for agents that never stop.

Claude Code just launched scheduled tasks, giving you the ability to run prompts on repeat in the background while your session stays active. This is an upgrade if you've ever started a deployment and spent the next hour constantly tabbing back to monitor its progress.

The easiest way to get started is by using “/loop”. Just provide a specific interval and your prompt:

If you skip the interval, it defaults to every 10 minutes. For one-off reminders, you can skip /loop entirely and simply describe what you need:

Tasks only run while Claude Code is active; if you close the session, everything stops. To keep them running continuously, you can leave a session open on a server or use an external cron job to launch new Claude Code sessions on a schedule.

How a staff engineer uses AI for spec-driven development: This tutorial shows developers how to speed up web building using AI agents. You'll learn how to turn Figma designs directly into functional websites, run multiple AI coding tasks at once, and use isolated workspaces for fast, hassle-free code reviews.

AI engineering field guide: A collection of real job postings, interview processes, take-home assignments, learning paths, and portfolio ideas for AI engineers.

Evaluating Opus 4.6 on BrowseComp (by Anthropic): Public AI benchmarks are often compromised because test answers frequently leak online. In a surprising turn of events, Claude 4.6 Opus independently recognized it was being tested, tracked down the specific benchmark it was taking, and decrypted the hidden answer key.

Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 200K+ engineers and 100K+ followers on socials. Get in touch.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team